brane 0.1.1 → 0.3.1

package/dist/commands/certify.js

@@ -0,0 +1,62 @@
+import { defineCommand } from "citty";
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { ensureBraneDir } from "../db/schema.js";
+import { getTailscaleHost } from "../tailscale.js";
+import { provisionTlsCert } from "../tls.js";
+function getCertsDir() {
+    const dir = join(ensureBraneDir(), "certs");
+    mkdirSync(dir, { recursive: true });
+    return dir;
+}
+export function getTlsCertPath() {
+    return join(getCertsDir(), "tls.crt");
+}
+export function getTlsKeyPath() {
+    return join(getCertsDir(), "tls.key");
+}
+export const certifyCommand = defineCommand({
+    meta: {
+        name: "certify",
+        description: "Provision TLS certificates for Tailscale HTTPS access",
+    },
+    args: {
+        host: {
+            type: "string",
+            description: "Tailscale hostname to certify (default: auto-detect)",
+        },
+    },
+    async run({ args }) {
+        const host = args.host ?? getTailscaleHost();
+        if (!host) {
+            console.error("Could not detect Tailscale hostname. Is Tailscale running?\n" +
+                "Use --host to specify the hostname manually.");
+            process.exit(1);
+        }
+        const certPath = getTlsCertPath();
+        const keyPath = getTlsKeyPath();
+        console.log(`Provisioning TLS certificate for ${host}...`);
+        const result = await provisionTlsCert({
+            host,
+            certPath,
+            keyPath,
+        });
+        if (!result.ok) {
+            console.error(`\nFailed to provision certificate (${result.reason}): ${result.message}`);
+            if (result.stderr)
+                console.error(result.stderr);
+            if (result.reason === "https_not_enabled") {
+                console.error("\nEnable HTTPS for your tailnet at https://login.tailscale.com/admin/dns");
+            }
+            else if (result.reason === "tailscale_missing") {
+                console.error("\nInstall Tailscale: https://tailscale.com/download");
+            }
+            process.exit(1);
+        }
+        console.log(`\nCertificate written to ${result.certPath}`);
+        console.log(`Key written to ${result.keyPath}`);
+        console.log(`Expires: ${result.notAfter.toISOString()}`);
+        console.log(`\nA running daemon will pick up the new cert automatically via fs.watch — no restart needed.`);
+    },
+});
+//# sourceMappingURL=certify.js.map

package/dist/commands/config.js

@@ -0,0 +1,133 @@
+import { defineCommand } from "citty";
+import { openDatabase } from "../db/schema.js";
+import { cleanAppHost } from "../shared/app-origin.js";
+// Well-known config keys and their defaults
+export const CONFIG_DEFAULTS = {
+    // The hostname that serves the shared app: where `brane meld` points a QR
+    // unless `--app` says otherwise, and what `GET /api/status` reports so a
+    // daemon's own bundle knows where Isolate hops out to. Never a trust
+    // decision: the daemon accepts any origin (SECURITY.md, Authentication).
+    // A fork changes this one line, and its daemons point at its own shell.
+    app_domain: "brane.organelle.dev",
+    "session-affinity.enabled": "true",
+};
+/** The shared app's host from a configured or given `app_domain` value,
+ *  reduced to a host (`cleanAppHost`); a blank one means the default, so
+ *  `brane config app_domain ""` or `brane meld --app ""` can never make a QR
+ *  for `https:///`. Every reader applies this one rule — `brane meld`
+ *  (`buildMeldUrl`) and `GET /api/status` (`statusAppDomain`) — so a daemon's
+ *  bundle and the QR always agree on where the shared app is. Lives here,
+ *  beside the default it falls back to, so the daemon need not import the
+ *  meld command to read it. */
+export function resolveAppHost(value) {
+    return cleanAppHost(value ?? "") || cleanAppHost(CONFIG_DEFAULTS.app_domain);
+}
+/** Reads a config key. Pass the caller's `db` whenever it has one: the daemon
+ *  and every test do. Without it this opens `~/.brane/brane.db` itself — right
+ *  for a CLI command, and exactly wrong anywhere else. That fallback is how a
+ *  test that drove a mention receipt used to open the operator's live database
+ *  and run the migration ladder on it, and how the daemon used to open (and
+ *  never close) a fresh connection on every `listen` reply. */
+export function getConfig(key, db) {
+    const conn = db ?? openDatabase();
+    try {
+        const row = conn.prepare("SELECT value FROM meta WHERE key = ?").get(`config.${key}`);
+        return row?.value ?? CONFIG_DEFAULTS[key];
+    }
+    finally {
+        if (!db)
+            conn.close();
+    }
+}
+export const configCommand = defineCommand({
+    meta: {
+        name: "config",
+        description: "Get or set brane configuration",
+    },
+    args: {
+        key: {
+            type: "positional",
+            description: "Configuration key",
+            required: false,
+        },
+        value: {
+            type: "positional",
+            description: "Value to set (omit to get current value)",
+            required: false,
+        },
+        list: {
+            type: "boolean",
+            description: "List all configuration values",
+        },
+        unset: {
+            type: "boolean",
+            description: "Remove a configuration key",
+        },
+    },
+    run({ args }) {
+        const db = openDatabase();
+        // --list: show all config
+        if (args.list) {
+            const rows = db
+                .prepare("SELECT key, value FROM meta WHERE key LIKE 'config.%' ORDER BY key")
+                .all();
+            if (rows.length === 0 && Object.keys(CONFIG_DEFAULTS).length === 0) {
+                console.log("No configuration set.");
+                return;
+            }
+            // Show defaults that haven't been overridden
+            const setKeys = new Set(rows.map((r) => r.key.replace(/^config\./, "")));
+            for (const [key, value] of Object.entries(CONFIG_DEFAULTS)) {
+                if (!setKeys.has(key)) {
+                    console.log(`${key}=${value} (default)`);
+                }
+            }
+            // Show explicitly set values
+            for (const row of rows) {
+                const key = row.key.replace(/^config\./, "");
+                console.log(`${key}=${row.value}`);
+            }
+            return;
+        }
+        const key = args.key;
+        if (!key) {
+            // No key provided and no --list flag: show usage
+            console.log("Usage: brane config <key> [value]");
+            console.log("       brane config --list");
+            console.log("       brane config --unset <key>");
+            return;
+        }
+        // --unset: remove a key
+        if (args.unset) {
+            const deleted = db.prepare("DELETE FROM meta WHERE key = ?").run(`config.${key}`);
+            if (deleted.changes > 0) {
+                console.log(`Unset ${key}`);
+            }
+            else {
+                console.log(`${key} is not set`);
+            }
+            return;
+        }
+        const value = args.value;
+        if (value === undefined) {
+            // Get
+            const row = db.prepare("SELECT value FROM meta WHERE key = ?").get(`config.${key}`);
+            if (row) {
+                console.log(row.value);
+            }
+            else if (CONFIG_DEFAULTS[key] !== undefined) {
+                console.log(`${CONFIG_DEFAULTS[key]} (default)`);
+            }
+            else {
+                // Key not found, exit silently like git config
+                process.exit(1);
+            }
+        }
+        else {
+            // Set
+            db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES (?, ?)").run(`config.${key}`, value);
+            console.log(`${key}=${value}`);
+        }
+    },
+});
+//# sourceMappingURL=config.js.map

package/dist/commands/cost.js

@@ -0,0 +1,126 @@
+import { defineCommand } from "citty";
+import { resolveDaemonEndpoint, daemonRequest, warnIfVersionMismatch } from "../daemon/client.js";
+import { formatCost } from "../shared/narrative-format.js";
+const backfillCommand = defineCommand({
+    meta: {
+        name: "backfill",
+        description: "Sweep the usage ledger over every narrative whose transcripts still exist",
+    },
+    args: {
+        "dry-run": {
+            type: "boolean",
+            description: "Report what would be recorded without writing anything",
+        },
+        all: {
+            type: "boolean",
+            description: "List every readable narrative, not just the ones that would change",
+        },
+    },
+    async run({ args }) {
+        try {
+            // The sweep runs in the daemon — readers resolve transcripts against its
+            // HOME and memoize in its process — so this is a client of
+            // POST /api/cost/backfill, in the same shape as `brane revive`.
+            const endpoint = await resolveDaemonEndpoint();
+            warnIfVersionMismatch(endpoint);
+            const result = await daemonRequest(endpoint, "/api/cost/backfill", {
+                method: "POST",
+                body: { dry_run: !!args["dry-run"] },
+            });
+            console.log(formatBackfillResult(result, { all: !!args.all }));
+        }
+        catch (err) {
+            console.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    },
+});
+export function formatBackfillResult(result, opts = {}) {
+    const changed = result.samples.filter((s) => s.new_rows > 0 || s.new_amount > 0 || s.after !== s.before);
+    const shown = opts.all ? result.samples : changed;
+    const verb = result.dry_run ? "would record" : "recorded";
+    const lines = [];
+    for (const s of shown) {
+        const delta = formatCost(s.new_amount, s.unit) ?? "0";
+        const before = formatCost(s.before, s.unit) ?? "—";
+        const after = formatCost(s.after, s.unit) ?? "—";
+        lines.push(`${s.nid.padEnd(18)} ${s.agent_type.padEnd(8)} ${s.readable}/${s.sessions} sessions  +${s.new_rows} rows (${delta})  ${before} → ${after}`);
+    }
+    // Per-unit totals of what this pass adds, never summed across units.
+    const byUnit = new Map();
+    for (const s of result.samples)
+        byUnit.set(s.unit, (byUnit.get(s.unit) ?? 0) + s.new_amount);
+    const totals = [...byUnit].map(([u, a]) => formatCost(a, u)).filter(Boolean).join(" · ") || "nothing";
+    lines.push(`${result.dry_run ? "[dry run] " : ""}${result.scanned} narratives scanned, ${result.samples.length} readable, ${changed.length} changed; ${verb} ${totals}`);
+    return lines.join("\n");
+}
+const repriceCommand = defineCommand({
+    meta: {
+        name: "reprice",
+        description: "Re-price recorded ledger rows under the current price table",
+    },
+    args: {
+        "dry-run": {
+            type: "boolean",
+            description: "Report what would change without writing anything",
+        },
+        all: {
+            type: "boolean",
+            description: "List every narrative that changes, not just the ten largest",
+        },
+    },
+    async run({ args }) {
+        try {
+            // Rewrites the daemon's ledger, so it goes through the daemon like
+            // backfill does — one writer, and the app hears about the new totals.
+            const endpoint = await resolveDaemonEndpoint();
+            warnIfVersionMismatch(endpoint);
+            const result = await daemonRequest(endpoint, "/api/cost/reprice", {
+                method: "POST",
+                body: { dry_run: !!args["dry-run"] },
+            });
+            console.log(formatRepriceResult(result, { all: !!args.all }));
+        }
+        catch (err) {
+            console.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    },
+});
+const usd = (n) => (n === null ? "—" : `$${n.toFixed(2)}`);
+export function formatRepriceResult(result, opts = {}) {
+    const lines = [];
+    for (const m of result.models) {
+        const mark = m.changed ? "" : "  (unchanged)";
+        lines.push(`${m.model.padEnd(20)} ${String(m.rows).padStart(6)} rows  ${usd(m.before)} → ${usd(m.after)}${mark}`);
+    }
+    // Largest corrections first; the full list only on request.
+    const shown = opts.all ? result.narratives : result.narratives.slice(0, 10);
+    if (shown.length)
+        lines.push("");
+    for (const n of shown) {
+        lines.push(`${n.nid.padEnd(18)} ledger ${usd(n.ledger_before)} → ${usd(n.ledger_after)}  card ${usd(n.column_before)} → ${usd(n.column_after)}`);
+    }
+    if (shown.length < result.narratives.length) {
+        lines.push(`… ${result.narratives.length - shown.length} more (--all to list them)`);
+    }
+    const before = result.models.reduce((a, m) => a + m.before, 0);
+    const after = result.models.reduce((a, m) => a + m.after, 0);
+    const verb = result.dry_run ? "would change" : "changed";
+    lines.push(`${result.dry_run ? "[dry run] " : ""}${result.scanned} priced rows, ${verb} ${result.changed} ` +
+        `across ${result.narratives.length} narratives: ${usd(before)} → ${usd(after)}` +
+        `; ${result.recovered} cache splits recovered` +
+        (result.unrecoverable ? `, ${result.unrecoverable} unrecoverable (left as recorded)` : ""));
+    return lines.join("\n");
+}
+export const costCommand = defineCommand({
+    meta: {
+        name: "cost",
+        description: "Cost ledger maintenance",
+    },
+    subCommands: {
+        backfill: backfillCommand,
+        reprice: repriceCommand,
+    },
+});
+//# sourceMappingURL=cost.js.map

package/dist/commands/daemon.js

@@ -0,0 +1,350 @@
+import { defineCommand } from "citty";
+import { spawn, execFileSync } from "node:child_process";
+import { openSync } from "node:fs";
+import { join } from "node:path";
+import { openDatabase, ensureBraneDir, getBraneDir, getDaemonAddress } from "../db/schema.js";
+import { startServer } from "../daemon/server.js";
+import { legacyTokenWarning } from "../db/tokens.js";
+import { withoutAgentEnv } from "../agent-env.js";
+import { getTlsCertPath } from "./certify.js";
+import { inspectCert } from "../tls.js";
+function getLogPath() {
+    return join(getBraneDir(), "daemon.log");
+}
+// During `daemon restart` the running daemon's `caffeinate -i` child is
+// killed when the old daemon shuts down, and a fresh one isn't established
+// until the new daemon boots far enough to call `keepAwake.start()`. That
+// leaves a brief window (death-poll granularity + new-daemon startup) with
+// no PreventUserIdleSystemSleep assertion held — and because releasing the
+// assertion doesn't reset macOS's idle timer, a machine already idle past
+// its sleep timeout becomes immediately sleep-eligible during that gap.
+//
+// To make the handoff break-free, the restart command itself spawns a
+// short-lived bridging assertion before tearing down the old daemon. It is
+// detached + unref'd so it outlives this CLI process, and self-expires via
+// `-t` so it never lingers as a duplicate of the new daemon's own child.
+// Darwin-only, matching KeepAwake; a no-op elsewhere.
+const RESTART_BRIDGE_SECONDS = 30;
+function spawnKeepAwakeBridge() {
+    if (process.platform !== "darwin")
+        return;
+    try {
+        const bridge = spawn("caffeinate", ["-i", "-t", String(RESTART_BRIDGE_SECONDS)], { stdio: "ignore", detached: true });
+        bridge.on("error", () => { }); // caffeinate missing — best effort, ignore
+        bridge.unref();
+        console.log(`Holding idle-sleep bridge for ${RESTART_BRIDGE_SECONDS}s across restart (caffeinate pid ${bridge.pid})`);
+    }
+    catch {
+        // Best effort: if the bridge can't spawn, restart still proceeds.
+    }
+}
+// Ask V8 to dump a heap snapshot when it's about to OOM and have Node
+// write a diagnostic report on any fatal error, both into ~/.brane so
+// they're easy to find after a crash.
+export function buildDaemonEnv() {
+    const diagnosticFlags = [
+        "--heapsnapshot-near-heap-limit=1",
+        "--report-on-fatalerror",
+        `--report-directory=${getBraneDir()}`,
+    ].join(" ");
+    const existing = process.env.NODE_OPTIONS;
+    // A daemon restarted from an agent's shell must not carry that agent's
+    // session: its token and its harness's session id would ride into every
+    // tmux server it starts, and from there into sessions that are not that
+    // agent (claude-jrjh1e8w:10, claude-eiuzl79r:33). See src/agent-env.ts.
+    const env = withoutAgentEnv(process.env);
+    return {
+        ...env,
+        BRANE_DAEMON_DETACHED: "1",
+        NODE_OPTIONS: existing ? `${existing} ${diagnosticFlags}` : diagnosticFlags,
+    };
+}
+/** Resolve the daemon port: explicit flag > previous port > 0 (OS-assigned) */
+function resolvePort(explicit, db) {
+    if (explicit)
+        return parseInt(explicit, 10);
+    // Try to reuse previous port
+    const prevRow = db.prepare("SELECT value FROM meta WHERE key = 'daemon_port'").get();
+    if (prevRow) {
+        return parseInt(prevRow.value, 10);
+    }
+    // Fall back to OS-assigned
+    return 0;
+}
+const daemonStart = defineCommand({
+    meta: {
+        name: "start",
+        description: "Start the brane daemon",
+    },
+    args: {
+        port: {
+            type: "string",
+            description: "Port to listen on (default: previous port, then random)",
+        },
+        token: {
+            type: "string",
+            description: "Also accept this token, stored as a hashed device token. " +
+                "Adopted once: after a rotation revokes it, passing it again does nothing",
+        },
+        bind: {
+            type: "string",
+            description: "Bind address (default: auto-detect localhost + Tailscale)",
+        },
+        foreground: {
+            type: "boolean",
+            description: "Run in foreground (default: detach)",
+        },
+    },
+    async run({ args }) {
+        const db = openDatabase();
+        const port = resolvePort(args.port, db);
+        // Check if daemon is already running (cleans up stale entries). The
+        // address is enough: a running daemon this shell cannot reach is still
+        // running, and a second one would only lose the claim.
+        const existing = getDaemonAddress(db);
+        if (existing) {
+            console.log(`Daemon already running. Exiting.`);
+            db.close();
+            return;
+        }
+        if (!args.foreground) {
+            db.close();
+            // Detach: re-spawn ourselves with --foreground in a detached child
+            ensureBraneDir();
+            const logFd = openSync(getLogPath(), "a");
+            const child = spawn(process.execPath, [...process.execArgv, ...process.argv.slice(1), "--foreground"], {
+                detached: true,
+                stdio: ["ignore", logFd, logFd],
+                env: buildDaemonEnv(),
+            });
+            child.unref();
+            console.log(`Daemon started in background (pid ${child.pid})`);
+            return;
+        }
+        await startServer({ port, db, token: args.token, bind: args.bind });
+    },
+});
+const daemonStop = defineCommand({
+    meta: {
+        name: "stop",
+        description: "Stop the brane daemon",
+    },
+    run() {
+        const db = openDatabase();
+        const pidRow = db
+            .prepare("SELECT value FROM meta WHERE key = 'daemon_pid'")
+            .get();
+        if (!pidRow) {
+            console.log("No daemon running.");
+            return;
+        }
+        const pid = parseInt(pidRow.value, 10);
+        try {
+            process.kill(pid, "SIGTERM");
+            console.log(`Sent SIGTERM to daemon (pid ${pid})`);
+        }
+        catch {
+            console.log(`Daemon process ${pid} not found. Cleaning up stale entry.`);
+            db.prepare("DELETE FROM meta WHERE key IN ('daemon_token', 'daemon_pid', 'daemon_version', 'daemon_tls', 'daemon_socket')").run();
+        }
+    },
+});
+const daemonStatus = defineCommand({
+    meta: {
+        name: "status",
+        description: "Show daemon status",
+    },
+    run() {
+        const db = openDatabase();
+        const pidRow = db.prepare("SELECT value FROM meta WHERE key = 'daemon_pid'").get();
+        const portRow = db.prepare("SELECT value FROM meta WHERE key = 'daemon_port'").get();
+        if (!pidRow) {
+            console.log("Daemon is not running.");
+            return;
+        }
+        const pid = parseInt(pidRow.value, 10);
+        let alive = false;
+        try {
+            process.kill(pid, 0);
+            alive = true;
+        }
+        catch {
+            alive = false;
+        }
+        console.log(`Daemon status: ${alive ? "running" : "dead (stale entry)"}`);
+        console.log(`  pid:   ${pid}`);
+        console.log(`  port:  ${portRow?.value ?? "unknown"}`);
+        // This machine's CLI holds no token: it reaches the daemon over this
+        // socket, which only this account can open.
+        const socketRow = db.prepare("SELECT value FROM meta WHERE key = 'daemon_socket'").get();
+        console.log(`  sock:  ${socketRow?.value ?? "none (this shell cannot reach it; see `brane daemon logs`)"}`);
+        const legacyWarning = legacyTokenWarning(db);
+        if (legacyWarning)
+            console.log(`\nNote: ${legacyWarning}`);
+        // TLS cert status — read directly from disk so we can report even if the
+        // daemon isn't responsive. The daemon's own CertManager is the source of
+        // truth for renewal scheduling; here we just surface the expiry.
+        const cert = inspectCert(getTlsCertPath());
+        if (cert) {
+            const daysLeft = Math.floor((cert.notAfter.getTime() - Date.now()) / 86_400_000);
+            const expiryLabel = daysLeft < 0 ? `EXPIRED ${-daysLeft}d ago`
+                : daysLeft === 0 ? "expires today"
+                    : `${daysLeft}d remaining`;
+            console.log(`  tls:   ${cert.notAfter.toISOString()} (${expiryLabel})`);
+        }
+        else {
+            console.log(`  tls:   none (daemon will provision one if Tailscale is running)`);
+        }
+        if (!alive) {
+            db.prepare("DELETE FROM meta WHERE key IN ('daemon_token', 'daemon_pid', 'daemon_version', 'daemon_tls', 'daemon_socket')").run();
+            console.log("\nCleaned up stale daemon entry.");
+        }
+    },
+});
+const daemonLogs = defineCommand({
+    meta: {
+        name: "logs",
+        description: "Show daemon logs",
+    },
+    args: {
+        follow: {
+            type: "boolean",
+            alias: "f",
+            description: "Follow log output (like tail -f)",
+        },
+        lines: {
+            type: "string",
+            alias: "n",
+            description: "Number of lines to show (default: 50)",
+        },
+    },
+    run({ args }) {
+        const logPath = getLogPath();
+        const lines = args.lines ?? "50";
+        const tailArgs = ["-n", lines];
+        if (args.follow)
+            tailArgs.push("-f");
+        tailArgs.push(logPath);
+        try {
+            execFileSync("tail", tailArgs, { stdio: "inherit" });
+        }
+        catch {
+            console.error(`No log file found at ${logPath}`);
+        }
+    },
+});
+const daemonRestart = defineCommand({
+    meta: {
+        name: "restart",
+        description: "Restart the brane daemon",
+    },
+    args: {
+        port: {
+            type: "string",
+            description: "Port to listen on (default: previous port, then random)",
+        },
+    },
+    async run({ args }) {
+        const db = openDatabase();
+        // Capture the previous port before stopping. No token needs carrying:
+        // this machine's CLI holds none, and the new daemon finds the device
+        // tokens' hashes in the database.
+        const prevPortRow = db
+            .prepare("SELECT value FROM meta WHERE key = 'daemon_port'")
+            .get();
+        const prevPort = args.port ?? prevPortRow?.value;
+        // Hold an idle-sleep assertion across the handoff *before* killing the
+        // old daemon, so there's no window where nothing prevents idle sleep.
+        spawnKeepAwakeBridge();
+        // Stop existing daemon if running
+        const pidRow = db
+            .prepare("SELECT value FROM meta WHERE key = 'daemon_pid'")
+            .get();
+        if (pidRow) {
+            const pid = parseInt(pidRow.value, 10);
+            try {
+                process.kill(pid, "SIGTERM");
+                console.log(`Sent SIGTERM to daemon (pid ${pid})`);
+                // Wait for it to die
+                for (let i = 0; i < 20; i++) {
+                    await new Promise((r) => setTimeout(r, 100));
+                    try {
+                        process.kill(pid, 0);
+                    }
+                    catch {
+                        break;
+                    }
+                }
+            }
+            catch {
+                // Already dead
+            }
+        }
+        db.close();
+        // Start fresh daemon (detached)
+        ensureBraneDir();
+        const logFd = openSync(getLogPath(), "a");
+        const startArgs = [...process.argv.slice(1)].filter((a) => a !== "restart" && !a.startsWith("--port") && !a.startsWith("--token"));
+        // Replace "restart" with "start" in the args
+        const idx = startArgs.indexOf("daemon");
+        const childArgs = [
+            ...process.execArgv,
+            ...startArgs.slice(0, idx + 1),
+            "start",
+            "--foreground",
+            ...(prevPort ? ["--port", prevPort] : []),
+        ];
+        const child = spawn(process.execPath, childArgs, {
+            detached: true,
+            stdio: ["ignore", logFd, logFd],
+            env: buildDaemonEnv(),
+        });
+        child.unref();
+        console.log(`Daemon restarted (pid ${child.pid})`);
+    },
+});
+/** Start the daemon in the background, unless one is already running, and
+ *  wait for it to be ready. Returns its address only: what a caller presents
+ *  is its own business (`resolveCredential` in daemon/client.ts). */
+export async function ensureDaemonRunning() {
+    ensureBraneDir();
+    const check = openDatabase();
+    const running = getDaemonAddress(check);
+    check.close();
+    if (running)
+        return running;
+    const logFd = openSync(getLogPath(), "a");
+    const cliArgs = process.argv.slice(0, 2);
+    const child = spawn(process.execPath, [...process.execArgv, cliArgs[1], "daemon", "start", "--foreground"], {
+        detached: true,
+        stdio: ["ignore", logFd, logFd],
+        env: buildDaemonEnv(),
+    });
+    child.unref();
+    // Poll for daemon to be ready (up to 5s)
+    for (let i = 0; i < 50; i++) {
+        await new Promise((r) => setTimeout(r, 100));
+        // The daemon writes its port only after bootstrapping tokens and binding
+        // its socket, so once the address is up the socket is too.
+        const db = openDatabase();
+        const address = getDaemonAddress(db);
+        db.close();
+        if (address)
+            return address;
+    }
+    throw new Error("Daemon failed to start within 5s");
+}
+export const daemonCommand = defineCommand({
+    meta: {
+        name: "daemon",
+        description: "Manage the brane daemon",
+    },
+    subCommands: {
+        start: daemonStart,
+        stop: daemonStop,
+        restart: daemonRestart,
+        status: daemonStatus,
+        logs: daemonLogs,
+    },
+});
+//# sourceMappingURL=daemon.js.map